Latency Can Become An Oracle
A shared prefix cache improves throughput, but a tenant can probe response time to learn whether another request populated a matching prefix.
cacheisolate replays ordered multi-tenant traffic under shared, fully isolated, and sensitivity-aware cache policies with explicit ownership.
The Demo
The shared policy identifies the secret alpha prefix through an 86 ms hit-miss gap. Selective isolation removes that inference while retaining one approved cross-tenant reuse event, equal to 50% of the shared reuse in the fixture.
The simulator establishes the policy tradeoff, not a universal timing threshold. Real serving stacks need jitter modeling, concurrency tests, authentication, and cache-key review.
Research Basis
Recent work demonstrates practical privacy leakage through shared LLM KV and prefix caches and motivates tenant-aware isolation.
Read the NDSS 2025 KV-cache leakage study.
The Isolation Boundary Had Its Own Leak
A cache-isolation auditor is only as trustworthy as its own key derivation. The cache key was built by joining the isolation namespace and the request prefix with an unescaped "|" separator — and in a real deployment, the tenant identifier feeding that namespace is exactly the kind of value an untrusted caller controls.
Verified directly: a legitimate tenant named victim requesting prefix private|patient=alice|diagnosis=alpha, and an attacker declaring itself tenant victim|private requesting prefix patient=alice|diagnosis=alpha, hashed to the identical cache key. Replaying the probe sequence with that crafted tenant id recovered the victim's private value through the tenant_isolated policy — the one policy this tool reports as leak-free.
Fixed by length-prefixing each component before hashing, so no combination of tenant or prefix content can shift the boundary between them. The published demo numbers — the 86 ms gap, the alpha inference under the shared policy, and zero leaks under tenant isolation and selective isolation — are unchanged; only the crafted-input collision is closed.